diff --git a/ChangeLog b/ChangeLog index e4af77e7..119d13f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ - better GraphicsMagick image write [bfriesen] - add missing read loops to spng, heif, giflib and ppm load [kleisauke] - block zero width or height images from imagemagick load [Koen1999] +- check for overflow in gifload height [lovell] 6/9/20 started 8.10.2 - update magicksave/load profile handling [kelilevi] diff --git a/libvips/foreign/gifload.c b/libvips/foreign/gifload.c index 0eec998c..73210a4c 100644 --- a/libvips/foreign/gifload.c +++ b/libvips/foreign/gifload.c @@ -700,8 +700,16 @@ vips_foreign_load_gif_scan_extension( VipsForeignLoadGif *gif ) static int vips_foreign_load_gif_set_header( VipsForeignLoadGif *gif, VipsImage *image ) { + const gint64 total_height = (gint64) gif->file->SHeight * gif->n; + + if( total_height <= 0 || + total_height > VIPS_MAX_COORD ) { + vips_error( "gifload", "%s", _( "image size out of bounds" ) ); + return( -1 ); + } + vips_image_init_fields( image, - gif->file->SWidth, gif->file->SHeight * gif->n, + gif->file->SWidth, total_height, (gif->has_colour ? 3 : 1) + (gif->has_transparency ? 1 : 0), VIPS_FORMAT_UCHAR, VIPS_CODING_NONE, gif->has_colour ?